rodauth 1.14.0 → 1.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62724514e9c4c31b8af9992d86ed3f1de98a38860ee7890f2da54e28fa4f2394
-  data.tar.gz: 58ba690b1c2e193728c6341d60df851e043fd3706ed1769c5ae6ecc0eed24592
+  metadata.gz: d3c6bdb8caddbc1197f6af32fffb55ed7f1f66b088849893ee01dd2584ca10ac
+  data.tar.gz: 429057d63aba07108ff8e7df142509c8c4459db6ddda89cd1869b82b2ab0c6e4
 SHA512:
-  metadata.gz: 8b187d024978cf9a7c22cc8f21e892dab50075c7eb2a605c45c7423cec186169e160d944e051d1e9c369222e373ee0e5ebd9effe217ca13f0d3edc7ec0e2875e
-  data.tar.gz: b990669e7aecbc09dcd90d89001ca35dd12fea964bbe1e8c29629b95f9a9bfe4fbb19cbcd683ab5b28575a7e00940aff087604e80f18c3d6c9a65b7bc658976b
+  metadata.gz: cceea61e53481439c655ad641a1b417200e65802996ce9ee99b03d1626a928dc073f5b96225e904b1c971407c0a96c05305a974a7f25f45199d78b2f9d612c7c
+  data.tar.gz: 05a840ba64a93b8f80e4dc58c52129b9720fa2f8ab80c7d4011dc5e0880f74818264af5ffc5ca995bc06255ab75fd8a187696d15fa1ff1024b2f01dc92305fd6

data/CHANGELOG

@@ -1,3 +1,7 @@
+=== 1.15.0 (2018-01-29)
+
+* Add create_account_set_password? and verify_account_set_password? methods to delay setting password until account verification (jeremyevans)
+
 === 1.14.0 (2017-12-19)
 
 * Don't allow unlocking expired accounts when using account_expiration and lockout features (jeremyevans)

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2015-2017 Jeremy Evans
+Copyright (c) 2015-2018 Jeremy Evans
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to

data/doc/change_password_notify.rdoc

@@ -2,16 +2,6 @@
 
 The change password notify feature emails the user when their password
 is changed using the change password feature.
-    auth_value_method :password_changed_email_subject, 'Password Changed'
-
-    auth_value_methods(
-      :password_changed_email_body
-    )
-    auth_methods(
-      :create_password_changed_email,
-      :send_password_changed_email
-    )
-
 
 == Auth Value Methods
 

data/doc/create_account.rdoc

@@ -14,6 +14,9 @@ create_account_notice_flash :: The flash notice to show after successful
 create_account_redirect :: Where to redirect after creating the account.
 create_account_route :: The route to the create account action. Defaults to
                         +create-account+.
+create_account_set_password? :: Whether to ask for a password to be set on the create
+                                account form.  Defaults to true.  If set to false, an
+                                alternative method to set the password should be used.
 
 == Auth Methods
 

data/doc/release_notes/1.15.0.txt

@@ -0,0 +1,21 @@
+= New Features
+
+* create_account_set_password? and verify_account_set_password?
+  configuration methods have been added to the create_account and
+  verify_account features.  Setting:
+  
+    verify_account_set_password? true
+
+  in your rodauth configuration will change Rodauth so that instead
+  of asking for a password on the create account form, it will ask for
+  a password on the verify account form.
+
+  This can fix a possible issue where an attacker creates an account
+  for a user with a password the attacker knows.  If the user clicks
+  on the link in the verify account email and clicks on the button on
+  the verify account page, the attacker would have have a verified
+  account that they know the password to.
+
+  By setting verify_account_set_password? to true, you can ensure that
+  only the user who has access to the email can enter the password for
+  the account.

data/doc/verify_account.rdoc

@@ -45,6 +45,9 @@ verify_account_resend_route :: The route to the verify account resend action.
 verify_account_route :: The route to the verify account action. Defaults to
                         +verify-account+.
 verify_account_session_key :: The key in the session to hold the verify account key temporarily.
+verify_account_set_password? :: Whether to ask for a password to be set on the verify account
+                                form.  Defaults to false.  If set to true, will automatically
+                                stop asking for passwords to be set on the create account form.
 verify_account_table :: The name of the verify account keys table.
 
 == Auth Methods

data/lib/rodauth/features/create_account.rb

@@ -16,6 +16,7 @@ module Rodauth
     redirect
 
     auth_value_method :create_account_autologin?, true
+    auth_value_method :create_account_set_password?, true
 
     auth_value_methods :create_account_link
 
@@ -41,10 +42,6 @@ module Rodauth
         password = param(password_param)
         new_account(login)
 
-        if account_password_hash_column
-          set_new_account_password(param(password_param))
-        end
-
         catch_error do
           if require_login_confirmation? && login != param(login_confirm_param)
             throw_error_status(unmatched_field_error_status, login_param, logins_do_not_match_message)
@@ -54,12 +51,18 @@ module Rodauth
             throw_error_status(invalid_field_error_status, login_param, login_does_not_meet_requirements_message)
           end
 
-          if require_password_confirmation? && password != param(password_confirm_param)
-            throw_error_status(unmatched_field_error_status, password_param, passwords_do_not_match_message)
-          end
+          if create_account_set_password?
+            if require_password_confirmation? && password != param(password_confirm_param)
+              throw_error_status(unmatched_field_error_status, password_param, passwords_do_not_match_message)
+            end
 
-          unless password_meets_requirements?(password)
-            throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
+            unless password_meets_requirements?(password)
+              throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
+            end
+
+            if account_password_hash_column
+              set_new_account_password(password)
+            end
           end
 
           transaction do
@@ -68,7 +71,7 @@ module Rodauth
               throw_error_status(invalid_field_error_status, login_param, login_does_not_meet_requirements_message)
             end
 
-            unless account_password_hash_column
+            if create_account_set_password? && !account_password_hash_column
               set_password(password)
             end
             after_create_account

data/lib/rodauth/features/verify_account.rb

@@ -32,8 +32,7 @@ module Rodauth
     auth_value_method :verify_account_id_column, :id
     auth_value_method :verify_account_key_column, :key
     auth_value_method :verify_account_session_key, :verify_account_key
-
-    auth_value_methods :verify_account_resend_link
+    auth_value_method :verify_account_set_password?, false
 
     auth_methods(
       :allow_resending_verify_account_email?,
@@ -108,20 +107,40 @@ module Rodauth
           redirect verify_account_redirect
         end
 
-        transaction do
-          before_verify_account
-          verify_account
-          remove_verify_account_key
-          after_verify_account
-        end
+        catch_error do
+          if verify_account_set_password?
+            password = param(password_param)
+
+            if require_password_confirmation? && password != param(password_confirm_param)
+              throw_error_status(unmatched_field_error_status, password_param, passwords_do_not_match_message)
+            end
+
+            unless password_meets_requirements?(password)
+              throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
+            end
+          end
+
+          transaction do
+            before_verify_account
+            verify_account
+            if verify_account_set_password?
+              set_password(password)
+            end
+            remove_verify_account_key
+            after_verify_account
+          end
 
-        if verify_account_autologin?
-          update_session
+          if verify_account_autologin?
+            update_session
+          end
+
+          session[verify_account_session_key] = nil
+          set_notice_flash verify_account_notice_flash
+          redirect verify_account_redirect
         end
 
-        session[verify_account_session_key] = nil
-        set_notice_flash verify_account_notice_flash
-        redirect verify_account_redirect
+        set_error_flash verify_account_error_flash
+        verify_account_view
       end
     end
 
@@ -194,6 +213,11 @@ module Rodauth
       "<p><a href=\"#{prefix}/#{verify_account_resend_route}\">Resend Verify Account Information</a></p>"
     end
 
+    def create_account_set_password?
+      return false if verify_account_set_password?
+      super
+    end
+
     private
 
     attr_reader :verify_account_key_value

data/lib/rodauth/version.rb

@@ -1,7 +1,7 @@
 # frozen-string-literal: true
 
 module Rodauth
-  VERSION = '1.14.0'.freeze
+  VERSION = '1.15.0'.freeze
 
   def self.version
     VERSION

data/spec/verify_account_spec.rb

@@ -55,6 +55,51 @@ describe 'Rodauth verify_account feature' do
     page.current_path.must_equal '/'
   end
 
+  [false, true].each do |ph|
+    it "should support setting passwords when verifying accounts #{'with account_password_hash_column' if ph}" do
+      rodauth do
+        enable :login, :create_account, :verify_account
+        account_password_hash_column :ph if ph
+        verify_account_autologin? false
+        verify_account_set_password? true
+      end
+      roda do |r|
+        r.rodauth
+        r.root{view :content=>""}
+      end
+
+      visit '/create-account'
+      fill_in 'Login', :with=>'foo@example2.com'
+      fill_in 'Confirm Login', :with=>'foo@example2.com'
+      click_button 'Create Account'
+      page.find('#notice_flash').text.must_equal "An email has been sent to you with a link to verify your account"
+
+      link = email_link(/(\/verify-account\?key=.+)$/, 'foo@example2.com')
+      visit link
+      fill_in 'Password', :with=>'0123456789'
+      fill_in 'Confirm Password', :with=>'012345678'
+      click_button 'Verify Account'
+      page.html.must_include("passwords do not match")
+      page.find('#error_flash').text.must_equal "Unable to verify account"
+
+      fill_in 'Password', :with=>'0123'
+      fill_in 'Confirm Password', :with=>'0123'
+      click_button 'Verify Account'
+      page.html.must_include("invalid password, does not meet requirements (minimum 6 characters)")
+      page.find('#error_flash').text.must_equal "Unable to verify account"
+
+      fill_in 'Password', :with=>'0123456789'
+      fill_in 'Confirm Password', :with=>'0123456789'
+      click_button 'Verify Account'
+      page.find('#notice_flash').text.must_equal "Your account has been verified"
+      page.current_path.must_equal '/'
+
+      login(:login=>'foo@example2.com', :password=>'0123456789')
+      page.find('#notice_flash').text.must_equal 'You have been logged in'
+      page.current_path.must_equal '/'
+    end
+  end
+
   it "should support autologin when verifying accounts" do
     rodauth do
       enable :login, :create_account, :verify_account

data/templates/create-account.str

@@ -3,7 +3,7 @@
   #{rodauth.csrf_tag}
   #{rodauth.render('login-field')}
   #{rodauth.render('login-confirm-field') if rodauth.require_login_confirmation?}
-  #{rodauth.render('password-field')}
-  #{rodauth.render('password-confirm-field') if rodauth.require_password_confirmation?}
+  #{rodauth.render('password-field') if rodauth.create_account_set_password?}
+  #{rodauth.render('password-confirm-field') if rodauth.create_account_set_password? && rodauth.require_password_confirmation?}
   #{rodauth.button(rodauth.create_account_button)}
 </form>

data/templates/verify-account.str

@@ -1,6 +1,8 @@
 <form method="post" class="rodauth form-horizontal" role="form" id="verify-account-form">
   #{rodauth.verify_account_additional_form_tags}
   #{rodauth.csrf_tag}
+  #{rodauth.render('password-field') if rodauth.verify_account_set_password?}
+  #{rodauth.render('password-confirm-field') if rodauth.verify_account_set_password? && rodauth.require_password_confirmation?}
   #{rodauth.button(rodauth.verify_account_button)}
 </form>
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 1.14.0
+  version: 1.15.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-12-19 00:00:00.000000000 Z
+date: 2018-01-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sequel
@@ -244,6 +244,7 @@ extra_rdoc_files:
 - doc/release_notes/1.12.0.txt
 - doc/release_notes/1.13.0.txt
 - doc/release_notes/1.14.0.txt
+- doc/release_notes/1.15.0.txt
 files:
 - CHANGELOG
 - MIT-LICENSE
@@ -278,6 +279,7 @@ files:
 - doc/release_notes/1.12.0.txt
 - doc/release_notes/1.13.0.txt
 - doc/release_notes/1.14.0.txt
+- doc/release_notes/1.15.0.txt
 - doc/release_notes/1.2.0.txt
 - doc/release_notes/1.3.0.txt
 - doc/release_notes/1.4.0.txt